Agentbeamdocs

Start here

MDM / Getting startedDevice managementOne place to understand your Apple and Windows fleet, deliver configuration, and request device actions.MDM / Getting startedSet up your workspaceRequest MDM access, check platform readiness, and get your first managed device into inventory.Agent CLI / Getting startedAgent CLI overviewUnderstand agent activity locally, scan the files your assistants use, and connect shared workspace controls when needed.Agent CLI / Getting startedCLI quickstartInstall Beam, capture a first event, and open your local activity dashboard.Agent CLI / Getting startedConnect a workspacePair your machine through the browser or an enrollment code, then verify identity and policy synchronization.
↑ ↓ to navigate · Enter to openEsc to close
Website Open dashboard
Agent CLI/Configuration
Configuration

Data, redaction & export

Know what stays local, what an enrolled collector can send, and how to preserve evidence within retention limits.

On this page

Beam's local collector stores normalized records under the data directory. Recognized secrets are redacted before persistence, but arbitrary sensitive prose or proprietary code may remain. Review records before sharing them outside their intended audience.

Local storage and limits

DataLocal behavior
EventsLatest 10,000 retained in bounded NDJSON storage
Scan reportsLatest 500 retained
Pairing tokenGenerated per data directory and reused across restarts
Workspace identityStored locally after connection; used for authenticated remote requests
Browser pairingStored in Studio's origin-scoped local storage until disconnected or rejected

Known credential formats, assignments, authorization headers, URL query strings, and private keys are redacted. Pattern-based redaction is not a complete classification of all confidential information.

Understand network boundaries

A plain beam scan or extraction preview stays offline. Local imports, Studio scans, and --save contact your loopback collector. If that collector is enrolled, it can forward events, saved scans, and review changes to its workspace.

Forwarding is best-effort. Batches are held in process memory, with up to 15 events per batch and a ten-second inactivity flush for smaller batches. It is not a durable retry queue; a network outage can leave local history missing from the dashboard.

Export local events

The authenticated GET /export endpoint returns redacted event NDJSON. Supply the pairing token through a securely configured environment variable rather than pasting it into shared command examples:

Code
curl --fail --silent --show-error \
  -H "Authorization: Bearer $BEAM_TOKEN" \
  http://127.0.0.1:4319/export \
  -o beam-events.ndjson

This file is a copy of retained local events. It does not include every historical event, prove completed effects, or replace the administrative dashboard audit export. Protect the output file under your evidence-handling process.

Control workspace payload collection

Owners and administrators can change Workspace → Identity & data collection preferences, including normalized raw payload collection. Disabling payload collection does not delete older stored payloads and does not stop ordinary event metadata from being collected.

The self-hosted dashboard has no automated retention deletion job. Establish an explicit operational retention process. Administrative audit is append-only through the application, but database administrators can alter records; it is not WORM storage.

Disconnect or delete

Studio's Disconnect clears browser pairing only. beam logout clears local workspace identity and attempts remote revocation. beam uninstall removes local data as well as hooks and services. Export required evidence before uninstalling and verify remote revocation separately when the workspace is unreachable.

Keep exploring

Explore the docs